A method and device for allocating a distributed lock is provided. A globally unique service process ID (SPI) is introduced for each distributed application service process while guaranteeing correctness of a distributed lock, and the SPI is used to directly manage ownership of the distributed lock. The service replacement process sends to the server a request for inheriting ownership of the distributed lock before the lifecycle of the lock file expires, the inherit request including the SPI.

A redundant computer system utilizing comparison diagnostics and voting techniques includes a plurality of redundant channels. Each pair of the processors receives/obtains process information from I/O modules via dual redundant sensors (DRS). The processors execute an application program, whereby output module is utilized for comparing output data of the two processors. Output module receives output data from neighboring modules, if there is a deviation or other disparity in the output data. Each pair of processors, a voter and an improper sequence detector component disables the output module, if a majority of signals vote that output module fails. In addition, the system uses 2-of-3 voting, the system remains operational in the presence of up two transient or hard failures.

A system for providing an output signal based on a generated surroundings model of surroundings of a mobile platform is proposed. The system includes: a first subsystem, a second subsystem, wherein the second subsystem is configured to redundantly provide a functionality of the first subsystem, and a third subsystem, wherein the third subsystem is configured to redundantly provide the functionality of the first subsystem and/or of the second subsystem; a first comparison system, a second comparison system, wherein the first comparison system and/or the second comparison system are configured to detect at least one fault in the first subsystem and/or a fault in the second subsystem and/or a fault in the third subsystem and/or to identify the corresponding faulty subsystem.

Methods and circuits are disclosed for error recovery in redundant processing systems. Respective instances of a software program are executed in lockstep on redundant processing circuits. Using a control circuit, in response to detecting a non-fatal error, an interrupt is generated and non-functioning ones of the processing circuits are disabled. The interrupt is serviced using the functional processing circuits operating in lockstep. In servicing the interrupt, a processing state of the processing circuits is stored and a reset of the processing circuits is triggered. Following the reset, the processing circuits are configured to operate in lockstep. The state of the processing circuits is restored to the stored processing state and a return from the interrupt is signaled. In response to the signaled return from interrupt, execution of the software program is resumed on the processing circuits in lockstep at a point at which the non-fatal error was detected.

Techniques are provided for metadata management for enabling automated switchover. An initial quorum vote may be performed before a node executes an operation associated with metadata comprising operational information and switchover information. After the initial quorum vote is performed, the node executes the operation upon one or more mailbox storage devices. Once the operation has executed, a final quorum vote is performed. The final quorum vote and the initial quorum vote are compared to determine whether the operation is to be designated as successful or failed, and whether any additional actions are to be performed.

A nuclear power plant control system including: a detection unit for detecting a specific event occurring in the nuclear power plant; an on-site equipment handling the event; and a majority decision judging device and an on-site equipment control device which constitute a plurality of control devices respectively operating independently. Each of the control devices includes a plurality of arithmetic units which perform arithmetic processes independently and in parallel based on a detection result of the detection unit, and output a signal for controlling the on-site equipment according to the results of operations of the arithmetic processes. The plurality of arithmetic units perform a matching process for harmonizing process statuses of the arithmetic processes of respective arithmetic units with each other when starting up the control devices, and after completing the matching process, respectively perform the arithmetic processes independently and in parallel.

A control system for an aerospace vehicle includes a voter and a plurality of control blocks. Each control block includes: a controller configured to receive an input signal and perform a control algorithm that includes an integral function on the input signal to provide an output signal; and a feedback controller that is configured to: receive the output signal from the controller, a reference signal from an external controller, and a plant feedback signal from an external plant; perform a feedback algorithm on the output signal to provide an feedback control signal; and perform a combinator algorithm using the reference signal, the plant feedback signal and the feedback control signal to provide the input signal to the controller; wherein the voter is configured to receive the output signals and perform a voting algorithm on the output signals to determine a control signal to provide to the external plant.